last executing test programs: 1m59.672056765s ago: executing program 2 (id=222): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f00000013c0)={0x3, 0x2, 0x2, {0x5, @vbi={0xb5, 0x0, 0x3, 0x20363159, [0x0, 0x8000000], [0x8200, 0x1]}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@bridge_dellink={0x20, 0x13, 0x5, 0x2, 0x0, {0x7, 0x0, 0x0, 0x0, 0x24000}}, 0x20}}, 0x0) ioctl$VIDIOC_QBUF(r0, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x0, 0x10, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "001500"}, 0x0, 0x2, {}, 0x58603}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x10000, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee9, 0x8031, 0xffffffffffffffff, 0xe6446000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x4001031, 0xffffffffffffffff, 0xe948f000) close(0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="180100000100a7d9000000000020b2008500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xd) r4 = dup(r3) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000080)=0x7) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r6, 0x5, 0x0, 0x0, @void, @value}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r2}, 0x20) sendmsg$inet(r1, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x2) 1m57.274575175s ago: executing program 2 (id=229): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0x29d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) readv(r1, &(0x7f0000002980)=[{&(0x7f0000000700)=""/163, 0xa3}], 0x2) 1m56.36674966s ago: executing program 2 (id=236): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x34, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x8, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x34}}, 0x0) 1m56.284896232s ago: executing program 2 (id=237): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, 0x5, 0x6, 0x401, 0x0, 0x0, {0x4, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x44001}, 0x2) 1m55.521044024s ago: executing program 2 (id=238): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000001, 0x4008031, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x5, 0x0, &(0x7f0000000040)) 1m53.99539499s ago: executing program 2 (id=243): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) read$FUSE(r0, &(0x7f0000009780)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt(0xffffffffffffffff, 0x28, 0x0, &(0x7f0000001680)=""/54, &(0x7f0000000000)=0x36) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r2, &(0x7f0000000080)={0x24, @none={0x0, 0x2}}, 0x14) 1m37.734847262s ago: executing program 32 (id=243): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) read$FUSE(r0, &(0x7f0000009780)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt(0xffffffffffffffff, 0x28, 0x0, &(0x7f0000001680)=""/54, &(0x7f0000000000)=0x36) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r2, &(0x7f0000000080)={0x24, @none={0x0, 0x2}}, 0x14) 1m9.391821757s ago: executing program 0 (id=366): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x44010, &(0x7f0000000040)={0x11, 0x4, r2, 0x1, 0x7}, 0x14) 1m8.265144416s ago: executing program 0 (id=368): r0 = io_uring_setup(0x4aec, &(0x7f0000000140)={0x0, 0x81fa, 0x80, 0x1, 0x7a}) io_uring_register$IORING_UNREGISTER_FILES(r0, 0x3, 0x0, 0x0) 1m7.212418364s ago: executing program 0 (id=372): r0 = add_key$user(0x0, &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$unlink(0x9, r0, r1) keyctl$chown(0x4, r0, 0x0, 0xee01) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000080)={0x1}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000015c0)={0x0, r3}, 0x18) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x50) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000080)=0x5, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x200c8004, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @mcast2}, 0x1c) sendto$inet6(r7, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c) sendto$inet6(r7, 0x0, 0x0, 0x44004010, 0x0, 0x0) msgctl$IPC_INFO(0x0, 0x3, &(0x7f00000017c0)=""/225) 1m5.64416723s ago: executing program 0 (id=375): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0xc048aec8, &(0x7f0000000080)={0x1, 0x0, @pic={0x0, 0x81, 0x9, 0x5, 0x3c, 0xfd, 0x5, 0x9, 0x4, 0xfc, 0xff, 0xf9, 0x55, 0x9, 0xf7, 0x7}}) 1m4.904378743s ago: executing program 0 (id=377): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x400, 0x0, 0x32}, 0x9c) 1m4.787851064s ago: executing program 0 (id=379): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = dup(r0) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0xffffffda, 0x3}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0, 0x9}, 0x8) prlimit64(0x0, 0xc, 0x0, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) syz_open_dev$sndmidi(0x0, 0x9, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x470}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 49.689505328s ago: executing program 33 (id=379): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = dup(r0) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0xffffffda, 0x3}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0, 0x9}, 0x8) prlimit64(0x0, 0xc, 0x0, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) syz_open_dev$sndmidi(0x0, 0x9, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x470}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) 13.503615844s ago: executing program 4 (id=513): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0xa00008, &(0x7f0000000140)={[{@min_batch_time={'min_batch_time', 0x3d, 0xd}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@noblock_validity}]}, 0x1, 0x7ad, &(0x7f00000007c0)="$eJzs3c9rG1ceAPDvyD/jZNdeWNjNngwLu4YQeZ31JruwsFn2sBQaCLTnJEZWTGrZCpYcYmNIQin00kNLD4XmknPTprdc++PaXvo39FAS0tYJTemhuIw0SmRbcpzEklL8+cBY782M9N533sybZ82gCWDfGk//5CIORwykydFsfhLZjOiPOFlf7+H6WiGdktjYeOW7pLbOg/W1QjS9J3Uwy/wxIj57I+JIbnu5lZXV+ZlSqbiU5SerCxcnKyurRy8szMwV54qLx6emp4+d+MeJ43sX6w9frh66+/b///rRyZ9e/8Ottz5P4mQcypY1x7FXxmM82yYD6Sbc5H97XViPJb2uAM8kPTT76kd5HI7R6NuhJf/T1ZoBAJ1yJSI2AIB9JnH+B4B9pvE9wIP1tUJjivr1nKs9/WKiS+79NyKG6/E3rm/Wl/TXr9l9NVy7DjryIKldI2lIImJsD8ofj4jrt8/cTKfo0HVIgFauXouIc2PjW/v/tIfbes/C0/rbLtYZ35LX/0H3fJKOf/65ffwXkcuO/+Ha363jn6EWx+6zePLxn7uzKTuwB4U2Scd//266t+1hU/yZsb4s95vamG8gOX+hVEz7tt9GxEQMDKX5qR3KmLj/8/12y5rHf9+/89oHafnp6+M1cnf6hza/Z3amOvM8MTe7dy3iT/2t4k8etX/SZvx7epdlvPSvN99vtyyNP423MW2Pv7M2bkT8pWX7P74PKtnx/sTJ2u4w2dgpWvj46/dG2pXf3P7Xb6clrRUa/wt0Q9r+IzvHP5Y0369Zefoyvrgx+mm7ZZvjP3MzLX9z/K33/8Hk1Vp6MJt3eaZaXZqKGExe3j7/2OP3NvKN9dP4J/7c+vjfaf9Pu6FzWXrjCTc/9t/99sNnj7+z0vhn0/ZPsiCe2P5Pn7j1cL6vXfm7a//pWmoim7O9/+vf9rm7reBzbTwAAAAAAAAAAAAAAAAAAAAAAAAA2KVcRByKJJd/lM7l8vn6M7x/HyO5UrlSPXK+vLw4G7VnZY/FQK7xU5ejTb+HOpX9Hn4jf2xL/u8R8buIeHfoQC2fL5RLs70OHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyB9s8/z/1zVCvawcAdMxwrysAAHSd8z8A7D9tzv+DrWcf6GhdAIDuqJ3/k/5eVwMA6CLf/wPA/uP8DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQIedPnUqnTZ+XF8rpPnZSyvL8+VLR2eLlfn8wnIhXygvXczPlctzpWK+UF5o+0FX6y+lcvnidCwuX56sFivVycrK6tmF8vJi9eyFhZm54tniQNciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDdq6yszs+USsUliZ0TV16IalzLmq3XW0PihUgMRUSnimjuJQ70pnMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+BX4JQAA//9qsh/Y") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) userfaultfd(0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') lseek(r1, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, r7}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7ffffcb8}]}) timer_getoverrun(0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x5, &(0x7f0000000180)=@framed={{}, [@map_val]}, &(0x7f0000000280)='GPL\x00', 0x5, 0xe2, &(0x7f00000002c0)=""/226, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xfecc) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) 8.733360284s ago: executing program 4 (id=523): socket$nl_generic(0x10, 0x3, 0x10) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x14) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000180)={{}, 'syz1\x00', 0x40}) shutdown(0xffffffffffffffff, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) pipe2$9p(0x0, 0x0) epoll_create(0x5) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$netlink(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r0 = syz_usb_connect(0x2, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000544fb2f00090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f00000000c0)=ANY=[@ANYRESOCT, @ANYRES8, @ANYBLOB="64269c078ecf07cf606ead008752ff8cb905655839261340b02fdfea038e1e07aa18e7dbce6657012a432e6f8535b1ccc4ff2a52fe666785c19e58236164c861"]) gettid() 8.32756111s ago: executing program 3 (id=527): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) r1 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r1, 0x20000005) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_open_procfs(0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_io_uring_setup(0x24fc, &(0x7f0000000400)={0x0, 0x3d58, 0x10100, 0x0, 0x21f}, &(0x7f00000003c0), &(0x7f0000000140)) io_uring_enter(r5, 0x1066, 0x0, 0x0, 0x0, 0x0) r6 = creat(&(0x7f00000002c0)='./file0\x00', 0x109) write$cgroup_type(r6, &(0x7f0000000280), 0x9) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r7, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) r8 = open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r8, 0x0) 5.593983446s ago: executing program 3 (id=532): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001812", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r5}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x1a, &(0x7f00000006c0)=@raw=[@ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x2}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}, @jmp={0x5, 0x1, 0x8, 0x6, 0x9, 0x1, 0x4}], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r8, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001940)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01dfffffff0000000000210000000c00018008000100", @ANYRES32=r7], 0x20}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r10, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r10, 0x0, 0x0, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 4.206558179s ago: executing program 4 (id=535): r0 = socket$nl_rdma(0x10, 0x3, 0x14) readv(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x10, 0x1409, 0x262543c4cee33fe7}, 0x10}}, 0x0) 4.047010452s ago: executing program 3 (id=536): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c00000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x44010, &(0x7f0000000040)={0x11, 0x4, r2, 0x1, 0x7}, 0x14) 3.825543576s ago: executing program 4 (id=537): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xa}, {}, {0x0, 0xffe0}}}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x8, 0x4}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_FLAGS_MASK={0x8, 0x30, 0x1}]}}]}, 0x3c}}, 0x24000000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.643343449s ago: executing program 6 (id=538): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000480)={0x0, 0x705, 0x2, 0x9, 0x1, [], [0x6, 0x2, 0x4, 0xffff7fff], [0xffffffe4, 0x45, 0x200, 0x4], [0x1, 0x7a46, 0x100000000, 0x3ff]}) 3.60904794s ago: executing program 3 (id=539): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500", @ANYRES32=r0], 0x90}}, 0x0) 3.523777811s ago: executing program 3 (id=540): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000cc0)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000011c0)="93bffce623851797a8dc79018d7716840ffc6941c667f6d345b18bc896d8f016f5f206bb2b0eb2fe32d2f0048678cd35ef833c35225ff95a94770a6845b091e69f243dea0d601c54e9c93ee3568b89a3427c84262ff67b679ccac305b5cea1dcd151d7bb5754603b6b0e362d8041bdc61529260e6c4046d55927c96dcce1609b9c4f8424b9da760270a470f95b99ebb6", 0x90}, {&(0x7f0000000400)="029993440c7a0c95d3bb8cf353fd63c588ffa39f0ff0fced20927ea4b2a247d082247558bef6b2b2cd6a0dffece1b36526e9388c344fb7ac429e434ccb0330483c0604aaf296d8218e240055cb92f17b1b47fd7b1b178ca0d1c470154ed985a179f87c9bc40206c86df9abc5be93ce0d96", 0x71}, {&(0x7f0000000f00)="397d5f2e855cb2b0b1e61d3fe47dc3e798cf47cfebf169e77257f308b498e5b417227094d569a4456954e58ea1850000000000000000355c5f42d9f2aa5f1b", 0x3f}], 0x3}}, {{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000700)="acc841985992b79554acfc02163bb0fb2bb293e68702bb40b6b870bde5700d368744361ae9fce3a4ff6bb3", 0x2b}, {&(0x7f0000000a00)="b1f56ee29c433328d3b2a83bd97e37007087acae7568edff43ed556d76770122635aea1dc48755381c71590cd542e796cc2669e2af442a03760c5cdfc691b3da35ad6a8d2ef9c2baa53a8dec36a2e434d46e643a1277b1dd932f3ef2cf46c257d6a19523b8b789ef34b46e461725b5e437323385b88c368f8bb5b933aa9169f5f7b51dd5319b8016623d1863d70581691a79a6678db1e5e7fa1c98c5b9e4a87272e9c4a1bd98dbb2ab76919ba5c1020e80bd0659e82d861dc6fe4c62639134c504aa438689d28748c22ebfe2772d64b64e706d94864d785dcc6b24fff7858b2a4edb673503cf002e28e331bc529b433cd74ab6c48a2c", 0xf6}, {&(0x7f0000000180)="5be3b011e12323e4ab88c0472f0700000000000000e71ba62334303d2db97401439932cfd4855c4cc243dae723789d8a9a16be3135c5f82691837c90ab19545f7a1dcf1449fd59eecae5f52fba1e89d6d34b39297bbbc2580600000000000000d6e36e737691a1c6bd2a64b2a85cbaaf648c9100000000000000006a8f4f5405596e72f8fe08c33a33b275787892f61fbb621794716f96031931b55af30fa01d72aa5a53ee4c07ab7c96a4a9ed93f4d20269982ab6feb22d8e77afb7b861622ab963b07f0026fd6424082bcd0864a854e542aacc3201", 0xd6}, {&(0x7f0000001000)="bd2f6aa36cea0e4bccda24dc5bd69ad762e998d923018ec9f30d63c7059c3c786069915581888508ff589f82857ff546b23b88d6bd61f1efc982005bf6c9abc4fe2caf32ef3ff105b69346a4d09afd7b0b8bd5f8c25f0eab84d8ad1b6576552ee2acc2ef0a9b0f9964d5705db134bdd9f261b7349aeede1c42e31b1082eec37b959d16afb967f54c471f2c7922c3c069f6a67c6ffee04bb1106c7e99752f50c7efdfa8afc8bd11acfc7a82e59dc5ffc88775bf6c9794b3ca2f475d25203ec0e0dd996b25d908e16539ac6e6086da296964d83ba527dc", 0xd6}], 0x4}}], 0x2, 0xc0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r0, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27) 3.481608862s ago: executing program 4 (id=541): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10c4, 0x8acf, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x3, [{{0x9, 0x4, 0x0, 0x0, 0xfd, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x0, 0x0, 0x6}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\v'], 0x0, 0x0, 0x0, 0x0}, 0x0) 2.765192284s ago: executing program 6 (id=542): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="60000000020601046c0001000000000000000000050005000a000000050001000600000005000400000000000900020073797a300000000014000300686173683a69702c706f72742c6970"], 0x60}}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) 2.667881486s ago: executing program 5 (id=543): mkdir(&(0x7f0000000040)='./file1\x00', 0x0) r0 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source', &(0x7f0000000380)='//\xf2b\x06\b\xba\xdfXo\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b/Q9\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce\x14\\8\\\x00\x00\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$MAP_CREATE(0x0, 0x0, 0x50) r7 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000080)=0x5, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x200c8004, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @mcast2}, 0x1c) sendto$inet6(r7, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c) sendto$inet6(r7, 0x0, 0x0, 0x44004010, 0x0, 0x0) msgctl$IPC_INFO(0x0, 0x3, &(0x7f00000017c0)=""/225) 2.464041099s ago: executing program 6 (id=547): r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='fdinfo\x00') fchdir(r0) mkdir(&(0x7f0000000140)='./file0\x00', 0x12) 2.332919391s ago: executing program 6 (id=548): socket$inet_tcp(0x2, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_open_dev$sndpcmc(&(0x7f0000000480), 0x1, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) pselect6(0x40, &(0x7f0000000000)={0x0, 0x2, 0x8000000000000000, 0x8000f, 0xffffffffffffffff, 0x0, 0x100, 0x10001000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xfffffffffffffffd, 0x8, 0x0, 0x0, 0x2, 0x5}, 0x0, 0x0) 2.165007614s ago: executing program 1 (id=549): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c00000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, 0x0, 0x0, 0x44010, &(0x7f0000000040)={0x11, 0x4, r2, 0x1, 0x7}, 0x14) 2.059643016s ago: executing program 1 (id=550): socket$inet6_udplite(0xa, 0x2, 0x88) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0xe) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0xb, &(0x7f0000000100)=0x3, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r4, 0x89f9, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000080)={'wg2\x00'}) r5 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x3f0, 0x0, 0x25, 0x148, 0x158, 0x60, 0x358, 0x2a8, 0x2a8, 0x358, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x110, 0x158, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x5e, 0x0, 0x9, 0x0, 0x2, 0xffffffff, 0x7, 0x18}}}, @common=@unspec=@ipvs={{0x48}, {@ipv4=@broadcast, [0x0, 0xffffff00, 0x0, 0xff], 0x4e21, 0x3c, 0x5, 0x4e21, 0x8, 0x8}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x1a0, 0x200, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x3, 0x2, 0x4, 'syz0\x00', 0x4}}, @common=@unspec=@statistic={{0x38}, {0x0, 0x0, 0x0, 0x80000, 0x8000}}]}, @common=@SET={0x60}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x450) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$getregset(0x4204, r6, 0x2, &(0x7f0000000100)={0x0}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00'}) 1.910197108s ago: executing program 1 (id=551): r0 = socket(0x11, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) sendmsg$netlink(r0, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="020114008cdc18000e3580009f000114600000060600ac141414e0000003808a8972bd0b72e41082b1a3d2061fd7fdfe4b88942a31f48597e36e039b1c599db6e466749c2d4c8303a0f7fbda34fb8825f80200e3c0ab42e32a097dbd4be5ffca88faca"], 0xdd12}, {&(0x7f0000000640)={0x10, 0x39, 0x100, 0x70bd2d, 0x25dfdbff}, 0x10}], 0x2, 0x0, 0x0, 0x44000}, 0x20040051) 1.851041469s ago: executing program 1 (id=552): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_emit_ethernet(0x6e, &(0x7f00000004c0)={@link_local, @local, @val={@val={0x88a8, 0x0, 0x0, 0x4}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "b33c83", 0x30, 0x3a, 0x0, @empty, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x9b5e, {0xe, 0x6, "90f26f", 0x5, 0x2f, 0x1, @dev={0xfe, 0x80, '\x00', 0x35}, @mcast2}}}}}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) add_key$fscrypt_v1(0x0, &(0x7f0000000040)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) ioctl$PIO_UNIMAP(r0, 0x4b52, &(0x7f0000000040)={0x0, 0x0}) 1.551792284s ago: executing program 5 (id=553): mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./bus\x00', 0xa4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) getdents64(r0, 0x0, 0x0) 1.465342376s ago: executing program 5 (id=554): bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000e40)={0x4, 0x0, [{0x0, 0xf3, &(0x7f00000008c0)=""/243}, {0xffff1000, 0x1000, &(0x7f0000004200)=""/4096}, {0x4000, 0x88, &(0x7f0000000b40)=""/136}, {0xdddd1000, 0x13, &(0x7f0000000200)=""/19}]}) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf, @void, @value}, 0x94) unshare(0x64000600) 1.398228747s ago: executing program 6 (id=555): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0xa00008, &(0x7f0000000140)={[{@min_batch_time={'min_batch_time', 0x3d, 0xd}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@noblock_validity}]}, 0x1, 0x7ad, &(0x7f00000007c0)="$eJzs3c9rG1ceAPDvyD/jZNdeWNjNngwLu4YQeZ31JruwsFn2sBQaCLTnJEZWTGrZCpYcYmNIQin00kNLD4XmknPTprdc++PaXvo39FAS0tYJTemhuIw0SmRbcpzEklL8+cBY782M9N533sybZ82gCWDfGk//5CIORwykydFsfhLZjOiPOFlf7+H6WiGdktjYeOW7pLbOg/W1QjS9J3Uwy/wxIj57I+JIbnu5lZXV+ZlSqbiU5SerCxcnKyurRy8szMwV54qLx6emp4+d+MeJ43sX6w9frh66+/b///rRyZ9e/8Ottz5P4mQcypY1x7FXxmM82yYD6Sbc5H97XViPJb2uAM8kPTT76kd5HI7R6NuhJf/T1ZoBAJ1yJSI2AIB9JnH+B4B9pvE9wIP1tUJjivr1nKs9/WKiS+79NyKG6/E3rm/Wl/TXr9l9NVy7DjryIKldI2lIImJsD8ofj4jrt8/cTKfo0HVIgFauXouIc2PjW/v/tIfbes/C0/rbLtYZ35LX/0H3fJKOf/65ffwXkcuO/+Ha363jn6EWx+6zePLxn7uzKTuwB4U2Scd//266t+1hU/yZsb4s95vamG8gOX+hVEz7tt9GxEQMDKX5qR3KmLj/8/12y5rHf9+/89oHafnp6+M1cnf6hza/Z3amOvM8MTe7dy3iT/2t4k8etX/SZvx7epdlvPSvN99vtyyNP423MW2Pv7M2bkT8pWX7P74PKtnx/sTJ2u4w2dgpWvj46/dG2pXf3P7Xb6clrRUa/wt0Q9r+IzvHP5Y0369Zefoyvrgx+mm7ZZvjP3MzLX9z/K33/8Hk1Vp6MJt3eaZaXZqKGExe3j7/2OP3NvKN9dP4J/7c+vjfaf9Pu6FzWXrjCTc/9t/99sNnj7+z0vhn0/ZPsiCe2P5Pn7j1cL6vXfm7a//pWmoim7O9/+vf9rm7reBzbTwAAAAAAAAAAAAAAAAAAAAAAAAA2KVcRByKJJd/lM7l8vn6M7x/HyO5UrlSPXK+vLw4G7VnZY/FQK7xU5ejTb+HOpX9Hn4jf2xL/u8R8buIeHfoQC2fL5RLs70OHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyB9s8/z/1zVCvawcAdMxwrysAAHSd8z8A7D9tzv+DrWcf6GhdAIDuqJ3/k/5eVwMA6CLf/wPA/uP8DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQIedPnUqnTZ+XF8rpPnZSyvL8+VLR2eLlfn8wnIhXygvXczPlctzpWK+UF5o+0FX6y+lcvnidCwuX56sFivVycrK6tmF8vJi9eyFhZm54tniQNciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDdq6yszs+USsUliZ0TV16IalzLmq3XW0PihUgMRUSnimjuJQ70pnMCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+BX4JQAA//9qsh/Y") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) userfaultfd(0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') lseek(r1, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00', r6}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7ffffcb8}]}) timer_getoverrun(0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x5, &(0x7f0000000180)=@framed={{}, [@map_val]}, &(0x7f0000000280)='GPL\x00', 0x5, 0xe2, &(0x7f00000002c0)=""/226, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xfecc) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) 1.003631443s ago: executing program 5 (id=556): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x503, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x0, 0x41001}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x10, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR={0xa}]}}}]}, 0x40}}, 0x0) 674.050919ms ago: executing program 1 (id=557): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f00007a7000/0x4000)=nil, &(0x7f0000834000/0x4000)=nil, 0x4000, 0x1}) 356.647244ms ago: executing program 5 (id=558): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0xbfa35000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) ftruncate(r0, 0xc17a) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) mlock(&(0x7f0000898000/0x4000)=nil, 0x4000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mincore(&(0x7f0000185000/0x3000)=nil, 0x3000, &(0x7f0000000240)=""/68) 6.552ms ago: executing program 4 (id=559): syz_open_dev$evdev(0x0, 0x20000, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) accept4$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2711, @my=0x1}, 0x10, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000300000100000014000180060001000200000008000300ac1414aa"], 0x28}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) shutdown(r2, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x28, r6, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}}, 0x0) 0s ago: executing program 6 (id=560): openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) inotify_add_watch(r0, 0x0, 0x10000000) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000020b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='sys_enter\x00', r2}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x181040, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) memfd_create(&(0x7f0000000bc0)='\xc0\x87:*\x18\xc1k\xa7\x87[\xa0o84I\xaaK\xa5\xd3\v\x86\xca<\x7f\xfd6\x8d}\xd8\xf2G\xb8\xeae)\x90\x86\xe3\x96\b\xe0\xfa\xb1\xd8N\xb2W\xcb\x8d}3lm8\xa57\xc9\x00HO\x00\x00\x00\x00R\xfc\xcb%u3\xec\xde%\x9d\xe4\x1d\rD\x82S\x17?\xd6\xb1\x9aF\xe2\xba[\xc7QR\x9f\x81\x8b\xdc\xc7\xdc\xdem\xbe\x7f2\x11\x17\xd8\xda@4\x9f\xc5*T\x1e^\xf7o\xff\xff\xff\xffwI\x02\xf3\xe3\x8d.\xd1=\xcf\xbf\x81\xb5\x8d%K\x1d\xe7_\xde\x87\xdd\xc1\xf0\x91\x1a!\xa5\xd3\v\xc9\x95d\xe3*\xa9\xfa\x99\xae\xb8\x89>\xc9\xf2/\x13{\x1a\x7f\x00\x00\x00\x00+$\xedX\xb7KV\x90\xc3D-\xf3\x8c\x9a\x15\x9c\xf5\xb4O\x17@d\x81+\xf6\xe6+\xed\r\xd2\xb3\xaa\x9b\x7fC\'\xa2\xf6\x12\xa1\x15Punfo\x7f\x92G\x0e.\xce\xd8h\xb9p2\xccC\xbaH\xc4\xdc\xe2\xa1%)\x85\xc7O]\'9\x92\xad\xfbJ\x02\x1d\x91-\xc99\t&\xbdq\x06`T\xc8\x92\xaf\xad\x06\xdd\xaf\x84\xf4\"\x13\xcf\xe5\x93D\xad~F\xe5\x19\xaa\xaa\xb2\xb1\x03m\x82+\x06\x1bF^\xd3n\xc4F\xc1\xc08\x94\xe6\xe5\x1f\xa7\xf6\xcaA\x90T\xf1\x1b\xe6\xb9\xe7\xff\xc5H\x04\x93\xca\xad\x17UlY\x9a}\r4\xac\x93\xac\v2\xc6\xf9\xbe\xfeI\x8b\xd4/`\xab\x1e\xcf\x7f\b\x94\xfe2.{\xc1\xbe\x9bth~\xcb\xb9E\x10W\xed\xed51[z\xb6>\xd3\xe7Y*\xdb\xa7h\nt\xddP\n\xc5\xeb\xb1ux\x94@\x00\x00g\x02D9\x83\xa7\x97\xf4\xb25wL\x97\xfb\xb9\xccj\xb3\x96\xc1@\xee`{\x87\xa8]\x96\x9cjF^+\xcc1l\xcbmA,5\xc4J\xcab\xa6\x91\xa0\xeaU\x92\x01\x1f,\xfa\x10\"+\x01\x00\x91\xe9\x1cz\xd1f\x901\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\"\x85Np\xba\x0e<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8V\xe4\xa1C\x90\x17\xcc{\x9d\xf1\xbd\xb0\xca\x03\x96\x85h}\x8f\x1c)X\xc83rA\x90r\xb6\xba!;\x95\xaf\xe0\xcb\xec\xcd$\x02f\x8c4\x1aH\x8fC\xbfr\xd39\x92\x1fShu\x9e\b\xd4m\xa8\x16\xa6\xd5\xae\xcb\x03oFQ\"\xf7F\xb7\vp\xb6\xe5\x92\xe2O}.\x95A\x9bH\x8d\xa1\x80\x1b\x14u\xfdK\xce\xaf\x94i\xf1s\xf7\xb8Jq\xcb3=M\x84\x7f\x181/\x9bQ|4\xaf\xcf\r\xcfz Z\x19\xad_\x13\x99\xf7\xfdOD\xd3\x9d\x9d\xb8d5g\xf1\x84\xbd\xe5\xa2\xb3\xda\x82\x10n1\xed\xba\xe3\x96\x85\"\xb6\xa6n\xe7\xfd\xd4\a\x97\x85\x810/\xc4o\x11\xc8\x1b\xc0\f\xeec\xa4\x7f|P\x00\x00\x00\x000p\xaf\xfdk\xac\xcc\xac`\xc9\a<\xadIt\x9b\xeb\x8a\xfe\x9b\aO\xa5?h\xe1B\xa8C\x8e;/\xa8\x94\x1bs\xf0\xa9>\x9e\xff\xc9\xd2\x00h\xcb\xfb\xb6Y\xbfp\xd8\x90\x96\xec\x83N\x8bNnx\xb6\x16Y\xf8sU\xae\xa0\b\x8cLq\n\x1f\x99t\xb6\xffozu\xa0B(\xe9?\xcdA\xba\xa8\x13Qc\xda\x16?\xe8z\x8f\x862!\xbf\xa4\xb8\x9bC\xe9Od\xe8\xd32m\x06RX\x7f\xf7\xc2\n\x94\xe5P:l\xd9\xd5\xbd\rH6-\x8a\x12m\xff\xe9\xa0\r\tk\xda\xa4q(\xae\\\xb6\x14I\xf7\xe0z\xf1 rejected, failed to enable media [ 136.459719][ T9] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 136.510634][ T9] EXT4-fs (loop0): This should not happen!! Data will be lost [ 136.510634][ T9] [ 136.748296][ T5019] netlink: 16 bytes leftover after parsing attributes in process `syz.4.258'. [ 137.905137][ T5029] netlink: 'syz.4.261': attribute type 10 has an invalid length. [ 137.970446][ T5033] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 138.080075][ T5029] netlink: 40 bytes leftover after parsing attributes in process `syz.4.261'. [ 138.395804][ T5029] team0: Port device geneve0 added [ 138.703852][ T5029] syz.4.261 (5029) used greatest stack depth: 19768 bytes left [ 139.094025][ T5047] netlink: 4 bytes leftover after parsing attributes in process `syz.4.269'. [ 139.108179][ T5047] device geneve2 entered promiscuous mode [ 142.865017][ T5075] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 143.324168][ T5084] netlink: 36 bytes leftover after parsing attributes in process `syz.1.279'. [ 144.116013][ T5083] loop0: detected capacity change from 0 to 2048 [ 144.317840][ T5083] EXT4-fs (loop0): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 145.182477][ T5106] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 145.197505][ T5106] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 145.209980][ T5106] EXT4-fs (loop0): This should not happen!! Data will be lost [ 145.209980][ T5106] [ 145.219789][ T5106] EXT4-fs (loop0): Total free blocks count 0 [ 145.225915][ T5106] EXT4-fs (loop0): Free/Dirty block details [ 145.232719][ T5106] EXT4-fs (loop0): free_blocks=66060288 [ 145.239482][ T5106] EXT4-fs (loop0): dirty_blocks=64 [ 145.244771][ T5106] EXT4-fs (loop0): Block reservation details [ 145.250832][ T5106] EXT4-fs (loop0): i_reserved_data_blocks=4 [ 146.819884][ T5107] delete_channel: no stack [ 146.826535][ T4239] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 146.870658][ T4239] EXT4-fs (loop0): This should not happen!! Data will be lost [ 146.870658][ T4239] [ 151.693365][ T4169] syz-executor (4169) used greatest stack depth: 19480 bytes left [ 151.787661][ T5157] loop3: detected capacity change from 0 to 2048 [ 151.798653][ T817] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.015518][ T817] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.764460][ T817] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.891882][ T5157] EXT4-fs (loop3): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 153.011032][ T817] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.061731][ T5173] process 'syz.0.311' launched './file0/../file0' with NULL argv: empty string added [ 153.101491][ T4341] Bluetooth: hci5: command 0x0409 tx timeout [ 153.226317][ T5183] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 153.242026][ T5183] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 153.254626][ T5183] EXT4-fs (loop3): This should not happen!! Data will be lost [ 153.254626][ T5183] [ 153.264408][ T5183] EXT4-fs (loop3): Total free blocks count 0 [ 153.270463][ T5183] EXT4-fs (loop3): Free/Dirty block details [ 153.276458][ T5183] EXT4-fs (loop3): free_blocks=66060288 [ 153.282117][ T5183] EXT4-fs (loop3): dirty_blocks=64 [ 153.287398][ T5183] EXT4-fs (loop3): Block reservation details [ 153.293585][ T5183] EXT4-fs (loop3): i_reserved_data_blocks=4 [ 153.901537][ T4341] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 153.922452][ T154] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 153.978675][ T154] EXT4-fs (loop3): This should not happen!! Data will be lost [ 153.978675][ T154] [ 154.102080][ T5136] chnl_net:caif_netlink_parms(): no params data found [ 154.191166][ T4341] usb 5-1: Using ep0 maxpacket: 32 [ 154.371276][ T4341] usb 5-1: config index 0 descriptor too short (expected 156, got 27) [ 154.411298][ T4341] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 154.821185][ T4341] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 154.840131][ T4341] usb 5-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 154.860004][ T4341] usb 5-1: config 0 interface 0 has no altsetting 0 [ 155.024147][ T4341] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 155.066772][ T4341] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 155.097844][ T4341] usb 5-1: Product: syz [ 155.157740][ T4341] usb 5-1: Manufacturer: syz [ 155.535172][ T4341] usb 5-1: SerialNumber: syz [ 155.691884][ T1107] Bluetooth: hci5: command 0x041b tx timeout [ 155.745874][ T4341] usb 5-1: config 0 descriptor?? [ 155.796927][ T5136] bridge0: port 1(bridge_slave_0) entered blocking state [ 155.804683][ T5136] bridge0: port 1(bridge_slave_0) entered disabled state [ 155.816034][ T4341] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 155.817648][ T5136] device bridge_slave_0 entered promiscuous mode [ 155.848966][ T5136] bridge0: port 2(bridge_slave_1) entered blocking state [ 155.856750][ T5136] bridge0: port 2(bridge_slave_1) entered disabled state [ 155.873708][ T5136] device bridge_slave_1 entered promiscuous mode [ 155.954067][ T4341] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 156.031866][ T4341] usb 5-1: USB disconnect, device number 3 [ 156.100446][ T4341] ldusb 5-1:0.0: LD USB Device #0 now disconnected [ 156.106995][ T5136] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 156.126724][ T5136] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 156.224155][ T5215] netlink: 16 bytes leftover after parsing attributes in process `syz.3.318'. [ 156.305462][ T5136] team0: Port device team_slave_0 added [ 156.351898][ T5136] team0: Port device team_slave_1 added [ 156.673550][ T5136] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 156.681216][ T5136] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.903831][ T4219] Bluetooth: hci5: command 0x040f tx timeout [ 157.925931][ T5136] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 157.979122][ T5136] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 158.001177][ T5136] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 158.049917][ T5136] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 158.194864][ T5136] device hsr_slave_0 entered promiscuous mode [ 158.219687][ T5136] device hsr_slave_1 entered promiscuous mode [ 158.251721][ T4271] Bluetooth: hci3: Frame reassembly failed (-84) [ 158.312572][ T5136] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 158.342350][ T5136] Cannot create hsr debugfs directory [ 159.377418][ T5250] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 160.121702][ T4341] Bluetooth: hci5: command 0x0419 tx timeout [ 160.301190][ T4219] Bluetooth: hci3: command 0x1003 tx timeout [ 160.308454][ T4173] Bluetooth: hci3: sending frame failed (-49) [ 160.363334][ T5260] netlink: 44 bytes leftover after parsing attributes in process `syz.4.327'. [ 162.090580][ T5136] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 162.195663][ T5136] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 162.203861][ T5278] overlayfs: failed to resolve './file1': -2 [ 162.255236][ T5136] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 162.281940][ T5136] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 162.391142][ T5149] Bluetooth: hci3: command 0x1001 tx timeout [ 162.888193][ T4173] Bluetooth: hci3: sending frame failed (-49) [ 163.377232][ T817] device hsr_slave_0 left promiscuous mode [ 163.481953][ T817] device hsr_slave_1 left promiscuous mode [ 163.544452][ T817] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 163.693282][ T817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 163.786513][ T817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 163.798855][ T817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 163.809627][ T817] device bridge_slave_1 left promiscuous mode [ 163.832470][ T817] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.896511][ T817] device bridge_slave_0 left promiscuous mode [ 163.907950][ T817] bridge0: port 1(bridge_slave_0) entered disabled state [ 164.059358][ T817] device veth1_macvtap left promiscuous mode [ 164.066427][ T817] device veth0_macvtap left promiscuous mode [ 164.079926][ T817] device veth1_vlan left promiscuous mode [ 164.087502][ T817] device veth0_vlan left promiscuous mode [ 164.941160][ T4219] Bluetooth: hci3: command 0x1009 tx timeout [ 165.050255][ T817] team0 (unregistering): Port device team_slave_1 removed [ 165.082404][ T817] team0 (unregistering): Port device team_slave_0 removed [ 165.116304][ T817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 165.162438][ T817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 165.396749][ T817] bond0 (unregistering): Released all slaves [ 165.553415][ T5136] 8021q: adding VLAN 0 to HW filter on device bond0 [ 165.606357][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 165.631911][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 165.674973][ T5136] 8021q: adding VLAN 0 to HW filter on device team0 [ 165.706337][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 165.724270][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 165.738268][ T5318] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.745414][ T5318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 165.801645][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 166.065063][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 166.081557][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 166.095292][ T5318] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.102431][ T5318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 166.237598][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 166.261426][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 166.416600][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 166.453389][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 166.477311][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 166.556648][ T5136] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 166.597196][ T5136] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 166.722163][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 166.929968][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 166.978625][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 167.122233][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 167.276086][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 167.400494][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 167.429814][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 167.462240][ T5360] ksmbd: Unknown IPC event: 6, ignore. [ 167.778095][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 167.975562][ T5377] x_tables: ip6_tables: SYNPROXY target: used from hooks PREROUTING, but only usable from INPUT/FORWARD [ 168.214892][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 169.070689][ T5136] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 169.641612][ T4341] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 169.688230][ T5394] loop1: detected capacity change from 0 to 2048 [ 169.732364][ T5398] netlink: 12 bytes leftover after parsing attributes in process `syz.3.347'. [ 169.972058][ T5394] EXT4-fs (loop1): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 170.053667][ T5407] xt_TCPMSS: Only works on TCP SYN packets [ 170.063564][ T4341] usb 5-1: Using ep0 maxpacket: 16 [ 170.242142][ T4341] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 170.445434][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 170.677575][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 170.811214][ T4341] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 170.831149][ T4341] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.839183][ T4341] usb 5-1: Product: syz [ 170.851134][ T4341] usb 5-1: Manufacturer: syz [ 170.881207][ T4341] usb 5-1: config 0 descriptor?? [ 170.890297][ T5416] netlink: 632 bytes leftover after parsing attributes in process `syz.4.350'. [ 170.911186][ T4341] usb 5-1: can't set config #0, error -71 [ 170.931301][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 170.958680][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 171.006916][ T5394] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 171.021666][ T5394] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 171.034054][ T5394] EXT4-fs (loop1): This should not happen!! Data will be lost [ 171.034054][ T5394] [ 171.043731][ T5394] EXT4-fs (loop1): Total free blocks count 0 [ 171.049764][ T5394] EXT4-fs (loop1): Free/Dirty block details [ 171.055700][ T5394] EXT4-fs (loop1): free_blocks=66060288 [ 171.061296][ T5394] EXT4-fs (loop1): dirty_blocks=64 [ 171.066424][ T5394] EXT4-fs (loop1): Block reservation details [ 171.072440][ T5394] EXT4-fs (loop1): i_reserved_data_blocks=4 [ 171.147885][ T4341] usb 5-1: USB disconnect, device number 4 [ 171.160393][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 171.181938][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 171.202347][ T5136] device veth0_vlan entered promiscuous mode [ 171.284811][ T5136] device veth1_vlan entered promiscuous mode [ 171.451621][ T5334] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 172.002406][ T5334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 172.021457][ T5334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 172.193148][ T5136] device veth0_macvtap entered promiscuous mode [ 172.226871][ T5427] netlink: 4 bytes leftover after parsing attributes in process `syz.0.354'. [ 172.639015][ T5136] device veth1_macvtap entered promiscuous mode [ 172.727509][ T5334] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 172.812844][ T5334] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 173.093476][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.133638][ T5436] loop8: detected capacity change from 0 to 1 [ 173.152298][ T5434] netlink: 40 bytes leftover after parsing attributes in process `syz.4.356'. [ 173.160186][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.187132][ T5436] Dev loop8: unable to read RDB block 1 [ 173.203533][ T5436] loop8: unable to read partition table [ 173.209263][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.237716][ T5436] loop8: partition table beyond EOD, truncated [ 173.265354][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.305339][ T5436] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 173.344864][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.369193][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.399953][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 173.456944][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 173.496256][ T5136] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 173.511495][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 173.794934][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 174.203174][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 174.264114][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 174.368552][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 174.379123][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 174.389798][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 174.419672][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 174.474433][ T5136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 174.512478][ T5136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 174.543540][ T5136] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 175.303030][ T4256] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 175.321329][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 175.334083][ T4181] block nbd3: Receive control failed (result -32) [ 175.334829][ T5452] block nbd3: shutting down sockets [ 175.382748][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 175.461089][ T4256] EXT4-fs (loop1): This should not happen!! Data will be lost [ 175.461089][ T4256] [ 175.473217][ T5136] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.500994][ T5136] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.522804][ T5136] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.574096][ T5136] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 175.702073][ T5472] delete_channel: no stack [ 175.796189][ T5476] netlink: 4 bytes leftover after parsing attributes in process `syz.0.366'. [ 176.831863][ T4262] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 176.840118][ T4262] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.642434][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 177.697844][ T4218] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.817868][ T4218] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.956824][ T5498] IPv6: Can't replace route, no match found [ 178.088883][ T5318] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 180.379871][ T5530] ksmbd: Unknown IPC event: 6, ignore. [ 186.011111][ T4219] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 186.061352][ T4341] Bluetooth: hci0: command 0x0406 tx timeout [ 186.071331][ T4245] Bluetooth: hci4: command 0x0406 tx timeout [ 186.248586][ T4245] Bluetooth: hci2: command 0x0406 tx timeout [ 186.283809][ T4245] Bluetooth: hci1: command 0x0406 tx timeout [ 186.821311][ T4219] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 186.861510][ T4219] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 187.073531][ T4219] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 187.866822][ T4219] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 188.352390][ T4219] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 188.371458][ T4219] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 188.393157][ T4219] usb 6-1: Manufacturer: syz [ 188.417758][ T4219] usb 6-1: config 0 descriptor?? [ 188.633291][ T5596] kvm [5595]: vcpu0, guest rIP: 0x18e disabled perfctr wrmsr: 0xc1 data 0x809 [ 190.078966][ T4219] rc_core: IR keymap rc-hauppauge not found [ 190.085714][ T5615] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 190.156778][ T4219] Registered IR keymap rc-empty [ 190.176905][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 190.211382][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 190.251714][ T4219] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 190.270833][ T4219] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input9 [ 190.481809][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 191.588626][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 191.621207][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 191.661272][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 191.788415][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 191.821293][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 193.281423][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 193.341348][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 194.224188][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.230525][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.331335][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 194.361251][ T4219] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 195.250332][ T5649] netlink: 212 bytes leftover after parsing attributes in process `syz.5.407'. [ 195.260804][ T4219] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 195.270070][ T4219] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 195.288794][ T4219] usb 6-1: USB disconnect, device number 2 [ 195.295101][ T5648] device netdevsim0 entered promiscuous mode [ 195.371488][ T5649] netlink: 44 bytes leftover after parsing attributes in process `syz.5.407'. [ 195.872495][ T26] audit: type=1326 audit(1742945655.377:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 195.894602][ C0] vkms_vblank_simulate: vblank timer overrun [ 196.195507][ T26] audit: type=1326 audit(1742945655.607:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 196.731215][ T4219] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 196.905898][ T26] audit: type=1326 audit(1742945655.707:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 196.927913][ C0] vkms_vblank_simulate: vblank timer overrun [ 197.471722][ T4219] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 197.641957][ T4219] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 197.647566][ T26] audit: type=1326 audit(1742945655.707:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 197.712632][ T4219] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 197.745606][ T26] audit: type=1326 audit(1742945655.707:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 197.768710][ T4219] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 197.824565][ T26] audit: type=1326 audit(1742945655.707:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 197.935722][ T26] audit: type=1326 audit(1742945655.707:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 197.958251][ T26] audit: type=1326 audit(1742945655.707:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f332672f169 code=0x7ffc0000 [ 197.982294][ T4219] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 197.984051][ T26] audit: type=1326 audit(1742945655.707:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f332672dad0 code=0x7ffc0000 [ 198.009969][ T4219] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 198.684656][ T4219] usb 6-1: Manufacturer: syz [ 198.693436][ T4219] usb 6-1: config 0 descriptor?? [ 198.715639][ T26] audit: type=1326 audit(1742945655.707:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5660 comm="syz.3.411" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f332672dad0 code=0x7ffc0000 [ 198.738564][ T4219] usb 6-1: can't set config #0, error -71 [ 198.780509][ T4219] usb 6-1: USB disconnect, device number 3 [ 200.231301][ T4219] Bluetooth: hci0: command 0x0409 tx timeout [ 200.426469][ T5713] netlink: 4 bytes leftover after parsing attributes in process `syz.5.422'. [ 200.789264][ T5318] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.890073][ T5689] chnl_net:caif_netlink_parms(): no params data found [ 200.960126][ T5318] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.079704][ T5731] usb usb1: check_ctrlrecip: process 5731 (syz.1.427) requesting ep 01 but needs 81 [ 201.132625][ T5318] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.171659][ T5731] usb usb1: usbfs: process 5731 (syz.1.427) did not claim interface 0 before use [ 201.239612][ T5734] loop5: detected capacity change from 0 to 2048 [ 201.254452][ T5318] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 201.996856][ T5734] EXT4-fs (loop5): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 202.206472][ T5689] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.227078][ T5689] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.245221][ T5689] device bridge_slave_0 entered promiscuous mode [ 202.293295][ T5689] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.415450][ T5753] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 202.430664][ T5753] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 202.443166][ T5753] EXT4-fs (loop5): This should not happen!! Data will be lost [ 202.443166][ T5753] [ 202.453025][ T5753] EXT4-fs (loop5): Total free blocks count 0 [ 202.459141][ T5753] EXT4-fs (loop5): Free/Dirty block details [ 202.465242][ T5753] EXT4-fs (loop5): free_blocks=66060288 [ 202.470982][ T5753] EXT4-fs (loop5): dirty_blocks=64 [ 202.476249][ T5753] EXT4-fs (loop5): Block reservation details [ 202.482337][ T5753] EXT4-fs (loop5): i_reserved_data_blocks=4 [ 202.967228][ T23] Bluetooth: hci0: command 0x041b tx timeout [ 203.214248][ T5689] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.221953][ T4262] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 203.222916][ T5689] device bridge_slave_1 entered promiscuous mode [ 203.302300][ T4262] EXT4-fs (loop5): This should not happen!! Data will be lost [ 203.302300][ T4262] [ 203.358523][ T5689] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 203.552986][ T5689] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.898191][ T5689] team0: Port device team_slave_0 added [ 205.101562][ T2304] Bluetooth: hci0: command 0x040f tx timeout [ 205.603132][ T5689] team0: Port device team_slave_1 added [ 205.787895][ T5689] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 205.808716][ T5689] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 206.811793][ T5788] netlink: 28 bytes leftover after parsing attributes in process `syz.5.439'. [ 206.936872][ T5689] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 207.083427][ T5689] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 207.091266][ T5689] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 207.132165][ T5796] loop1: detected capacity change from 0 to 2048 [ 207.144991][ T5788] netlink: 28 bytes leftover after parsing attributes in process `syz.5.439'. [ 207.152483][ T5689] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 207.181425][ T2304] Bluetooth: hci0: command 0x0419 tx timeout [ 207.291580][ T5796] EXT4-fs (loop1): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 207.427655][ T5689] device hsr_slave_0 entered promiscuous mode [ 207.460977][ T5689] device hsr_slave_1 entered promiscuous mode [ 207.471216][ T4341] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 207.482319][ T5788] netlink: 28 bytes leftover after parsing attributes in process `syz.5.439'. [ 207.512984][ T5689] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 207.547290][ T5689] Cannot create hsr debugfs directory [ 207.648312][ T5809] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 207.664083][ T5809] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 207.676817][ T5809] EXT4-fs (loop1): This should not happen!! Data will be lost [ 207.676817][ T5809] [ 207.686615][ T5809] EXT4-fs (loop1): Total free blocks count 0 [ 207.692693][ T5809] EXT4-fs (loop1): Free/Dirty block details [ 207.698656][ T5809] EXT4-fs (loop1): free_blocks=66060288 [ 207.704296][ T5809] EXT4-fs (loop1): dirty_blocks=64 [ 207.709471][ T5809] EXT4-fs (loop1): Block reservation details [ 207.715542][ T5809] EXT4-fs (loop1): i_reserved_data_blocks=4 [ 208.107119][ T4262] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 208.129126][ T4262] EXT4-fs (loop1): This should not happen!! Data will be lost [ 208.129126][ T4262] [ 208.271322][ T4341] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 208.295015][ T4341] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 208.345081][ T4341] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 208.355462][ T4341] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 208.461444][ T4341] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 208.505596][ T4341] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 208.548300][ T4341] usb 5-1: Manufacturer: syz [ 208.572070][ T4341] usb 5-1: config 0 descriptor?? [ 209.724718][ T5830] netlink: 48 bytes leftover after parsing attributes in process `syz.1.449'. [ 209.802277][ T4341] rc_core: IR keymap rc-hauppauge not found [ 209.808232][ T4341] Registered IR keymap rc-empty [ 209.835805][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 209.876614][ T5318] device hsr_slave_0 left promiscuous mode [ 209.882829][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 209.893542][ T5318] device hsr_slave_1 left promiscuous mode [ 209.906286][ T5318] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 209.923193][ T5318] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 209.932065][ T4341] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 209.952337][ T4341] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input10 [ 209.970922][ T5318] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 209.978984][ T5850] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 209.982019][ T5318] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 209.985895][ T5850] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 210.004337][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.015063][ T5318] device bridge_slave_1 left promiscuous mode [ 210.031307][ T5318] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.042958][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.049645][ T5850] vhci_hcd vhci_hcd.0: Device attached [ 210.058884][ T5318] device bridge_slave_0 left promiscuous mode [ 210.066439][ T5318] bridge0: port 1(bridge_slave_0) entered disabled state [ 210.074322][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.082848][ T5856] loop3: detected capacity change from 0 to 2048 [ 210.096198][ T5318] device veth1_macvtap left promiscuous mode [ 210.102595][ T5318] device veth0_macvtap left promiscuous mode [ 210.109216][ T5318] device veth1_vlan left promiscuous mode [ 210.115396][ T5318] device veth0_vlan left promiscuous mode [ 210.121212][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.151529][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.164129][ T5856] EXT4-fs (loop3): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 210.187080][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.221330][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.262655][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.311433][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.358571][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 210.382329][ T21] vhci_hcd: vhci_device speed not set [ 210.402763][ T4341] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 210.417806][ T4341] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 210.448840][ T5318] team0 (unregistering): Port device team_slave_1 removed [ 210.456521][ T21] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 210.718665][ T5862] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 210.733599][ T5862] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 210.746096][ T5862] EXT4-fs (loop3): This should not happen!! Data will be lost [ 210.746096][ T5862] [ 210.755787][ T5862] EXT4-fs (loop3): Total free blocks count 0 [ 210.762015][ T5862] EXT4-fs (loop3): Free/Dirty block details [ 210.767933][ T5862] EXT4-fs (loop3): free_blocks=66060288 [ 210.773527][ T5862] EXT4-fs (loop3): dirty_blocks=64 [ 210.778649][ T5862] EXT4-fs (loop3): Block reservation details [ 210.784866][ T5862] EXT4-fs (loop3): i_reserved_data_blocks=4 [ 210.845270][ T23] usb 5-1: USB disconnect, device number 5 [ 210.853012][ T5318] team0 (unregistering): Port device team_slave_0 removed [ 210.901818][ T5318] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 210.963779][ T5318] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 211.033828][ T4256] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 211.118457][ T4256] EXT4-fs (loop3): This should not happen!! Data will be lost [ 211.118457][ T4256] [ 211.641851][ T5318] bond0 (unregistering): Released all slaves [ 211.915831][ T5689] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 212.043785][ T5689] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 212.069615][ T5689] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 212.160551][ T5689] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 212.783451][ T5894] netlink: 48 bytes leftover after parsing attributes in process `syz.5.461'. [ 212.963667][ T5689] 8021q: adding VLAN 0 to HW filter on device bond0 [ 212.978126][ T5852] vhci_hcd: connection reset by peer [ 213.098559][ T4256] vhci_hcd: stop threads [ 213.165805][ T5689] 8021q: adding VLAN 0 to HW filter on device team0 [ 213.179043][ T4256] vhci_hcd: release socket [ 213.402991][ T4256] vhci_hcd: disconnect device [ 213.416038][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 213.506453][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 213.563319][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 213.586800][ T5914] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 213.676283][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 213.710051][ T4262] bridge0: port 1(bridge_slave_0) entered blocking state [ 213.717228][ T4262] bridge0: port 1(bridge_slave_0) entered forwarding state [ 213.725893][ T5913] loop3: detected capacity change from 0 to 2048 [ 213.733157][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 213.742589][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 213.751893][ T4262] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.758981][ T4262] bridge0: port 2(bridge_slave_1) entered forwarding state [ 213.789879][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 213.849783][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 213.874530][ T5913] EXT4-fs (loop3): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 213.887972][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 213.930117][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 213.971193][ T4341] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 214.012566][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 214.021852][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 214.032019][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 214.042298][ T4218] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 214.156120][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 214.171904][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 214.192100][ T5689] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 214.212736][ T5689] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 214.313061][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 214.395520][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 214.553174][ T4341] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 214.584081][ T4341] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 214.651281][ T4341] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 214.702204][ T4341] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 214.851363][ T4341] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 214.880965][ T4341] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 214.884726][ T5317] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 214.914314][ T5317] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 214.921926][ T4341] usb 5-1: Manufacturer: syz [ 214.964928][ T5689] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 214.968395][ T4341] usb 5-1: config 0 descriptor?? [ 215.521411][ T4341] rc_core: IR keymap rc-hauppauge not found [ 215.527787][ T4341] Registered IR keymap rc-empty [ 215.555661][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 215.734279][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 215.905863][ T4341] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 216.088673][ T4341] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input11 [ 216.322693][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 216.371439][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 216.386241][ T21] vhci_hcd: vhci_device speed not set [ 216.423440][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 216.481334][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 216.505930][ T5967] xt_TCPMSS: Only works on TCP SYN packets [ 217.251187][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 217.331976][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 217.419930][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 217.483419][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 217.521117][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 217.544533][ T5974] netlink: 8 bytes leftover after parsing attributes in process `syz.4.474'. [ 217.571176][ T5975] netlink: 48 bytes leftover after parsing attributes in process `syz.1.475'. [ 217.581846][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 217.624993][ T5689] device veth0_vlan entered promiscuous mode [ 217.641229][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 217.659973][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 217.672438][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 217.681675][ T4341] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 217.694021][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 217.719700][ T4341] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 217.734145][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 217.791084][ T4341] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 217.806174][ T5689] device veth1_vlan entered promiscuous mode [ 217.878482][ T4341] usb 5-1: USB disconnect, device number 6 [ 217.978610][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 218.028484][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 218.077995][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 218.112076][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 218.166566][ T5689] device veth0_macvtap entered promiscuous mode [ 218.423105][ T5317] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 218.466376][ T5991] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 218.498607][ T5689] device veth1_macvtap entered promiscuous mode [ 218.812776][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 218.829973][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 218.845728][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 218.877481][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 218.935847][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 219.191182][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 219.206465][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 219.282184][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 219.395053][ T6000] fuse: Bad value for 'fd' [ 219.407154][ T5689] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 219.425819][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 219.452618][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 219.499141][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 219.545064][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 219.676664][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 219.698267][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 219.728884][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 219.975170][ T4219] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 219.998727][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 220.019278][ T5689] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 220.060787][ T5689] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 220.108745][ T5689] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 220.401138][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 220.420476][ T4256] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 220.483145][ T5689] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.513171][ T5689] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.562651][ T6023] xt_TCPMSS: Only works on TCP SYN packets [ 220.728429][ T5689] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.893493][ T5689] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 221.341945][ T4219] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 221.352584][ T4219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 221.364235][ T4219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 221.374021][ T4219] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 221.471408][ T4219] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 221.480555][ T4219] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 221.491583][ T4262] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 221.498964][ T4219] usb 5-1: Manufacturer: syz [ 221.513620][ T4262] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 221.520524][ T4219] usb 5-1: config 0 descriptor?? [ 221.535012][ T6028] netlink: 48 bytes leftover after parsing attributes in process `syz.5.487'. [ 221.634223][ T5317] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 222.184972][ T5317] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 222.204147][ T5317] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 222.267742][ T4262] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 222.291215][ T4219] rc_core: IR keymap rc-hauppauge not found [ 222.297830][ T4219] Registered IR keymap rc-empty [ 222.352795][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 222.621355][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 222.671800][ T4219] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 222.740491][ T4219] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input12 [ 222.920719][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 223.716359][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 223.761156][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 223.801232][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 223.871275][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 223.907587][ T6055] loop6: detected capacity change from 0 to 2048 [ 223.916105][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 224.122040][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 224.151218][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 226.101580][ T6068] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 226.271272][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 226.320374][ T6076] netlink: 48 bytes leftover after parsing attributes in process `syz.3.497'. [ 226.366647][ T6081] tmpfs: Unknown parameter 'usrquota' [ 226.460073][ T4219] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 226.468514][ T6055] EXT4-fs (loop6): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 226.492957][ T4219] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 226.532759][ T4219] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 226.628383][ T6087] xt_TCPMSS: Only works on TCP SYN packets [ 227.036398][ T4219] usb 5-1: USB disconnect, device number 7 [ 227.609550][ T6101] netlink: 4 bytes leftover after parsing attributes in process `syz.3.505'. [ 228.213388][ T4219] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 228.605740][ T6101] bond0: (slave bond_slave_0): Releasing backup interface [ 228.705753][ T7] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 228.989809][ T6124] netlink: 48 bytes leftover after parsing attributes in process `syz.3.510'. [ 229.801712][ T4219] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 229.882837][ T4219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 229.921503][ T6129] BFS-fs: bfs_fill_super(): No BFS filesystem on nullb0 (magic=00000000) [ 230.099933][ T4219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 230.110078][ T4219] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 230.141637][ T7] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.212137][ T4219] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 230.984730][ T7] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 231.022225][ T4219] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 231.159197][ T7] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.179458][ T4219] usb 5-1: Manufacturer: syz [ 231.387528][ T4219] usb 5-1: config 0 descriptor?? [ 231.410917][ T7] usb 7-1: config 0 descriptor?? [ 231.532327][ T4219] usb 5-1: can't set config #0, error -71 [ 231.545012][ T7] usb 7-1: can't set config #0, error -71 [ 232.082426][ T4219] usb 5-1: USB disconnect, device number 8 [ 232.095776][ T7] usb 7-1: USB disconnect, device number 2 [ 232.424994][ T6143] loop4: detected capacity change from 0 to 2048 [ 232.608448][ T6163] ieee802154 phy0 wpan0: encryption failed: -22 [ 233.993146][ T6143] EXT4-fs (loop4): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 234.209181][ T6180] netlink: 48 bytes leftover after parsing attributes in process `syz.6.522'. [ 235.573345][ T6187] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 235.588101][ T6187] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 235.600484][ T6187] EXT4-fs (loop4): This should not happen!! Data will be lost [ 235.600484][ T6187] [ 235.610161][ T6187] EXT4-fs (loop4): Total free blocks count 0 [ 235.616179][ T6187] EXT4-fs (loop4): Free/Dirty block details [ 235.622105][ T6187] EXT4-fs (loop4): free_blocks=66060288 [ 235.627660][ T6187] EXT4-fs (loop4): dirty_blocks=64 [ 235.632812][ T6187] EXT4-fs (loop4): Block reservation details [ 235.638799][ T6187] EXT4-fs (loop4): i_reserved_data_blocks=4 [ 236.296325][ T5318] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 236.372352][ T5318] EXT4-fs (loop4): This should not happen!! Data will be lost [ 236.372352][ T5318] [ 236.503727][ T6192] tmpfs: Unknown parameter 'usrquota' [ 239.449117][ T7] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 240.821302][ T7] usb 5-1: device descriptor read/all, error -71 [ 241.090083][ T6235] loop1: detected capacity change from 0 to 2048 [ 241.197314][ T6242] netlink: 48 bytes leftover after parsing attributes in process `syz.3.536'. [ 241.380415][ T6235] EXT4-fs (loop1): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 241.451760][ T6252] netlink: 28 bytes leftover after parsing attributes in process `syz.3.539'. [ 241.777541][ T6263] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 241.793079][ T6263] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 241.805711][ T6263] EXT4-fs (loop1): This should not happen!! Data will be lost [ 241.805711][ T6263] [ 241.815556][ T6263] EXT4-fs (loop1): Total free blocks count 0 [ 241.821755][ T6263] EXT4-fs (loop1): Free/Dirty block details [ 241.827759][ T6263] EXT4-fs (loop1): free_blocks=66060288 [ 241.833425][ T6263] EXT4-fs (loop1): dirty_blocks=64 [ 241.838608][ T6263] EXT4-fs (loop1): Block reservation details [ 241.844696][ T6263] EXT4-fs (loop1): i_reserved_data_blocks=4 [ 242.404224][ T5317] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 242.415865][ T6268] netlink: 20 bytes leftover after parsing attributes in process `syz.6.542'. [ 242.458423][ T5317] EXT4-fs (loop1): This should not happen!! Data will be lost [ 242.458423][ T5317] [ 242.491609][ T6268] netlink: 20 bytes leftover after parsing attributes in process `syz.6.542'. [ 242.756046][ T7] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 242.801307][ T21] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 242.905300][ T6286] netlink: 48 bytes leftover after parsing attributes in process `syz.1.549'. [ 243.085027][ T7] usb 5-1: Using ep0 maxpacket: 8 [ 243.211407][ T21] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 243.217472][ T7] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 243.236487][ T21] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 243.250405][ T21] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 243.254040][ T7] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 243.261349][ T21] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 243.439130][ T21] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 243.457684][ T7] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 243.476374][ T21] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 243.485593][ T21] usb 4-1: Manufacturer: syz [ 243.499602][ T21] usb 4-1: config 0 descriptor?? [ 243.510664][ T7] usb 5-1: New USB device found, idVendor=10c4, idProduct=8acf, bcdDevice= 0.00 [ 243.538660][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.579968][ T7] usb 5-1: config 0 descriptor?? [ 243.718124][ T6313] loop6: detected capacity change from 0 to 2048 [ 243.825240][ T6313] EXT4-fs (loop6): mounted filesystem without journal. Opts: min_batch_time=0x000000000000000d,mb_optimize_scan=0x0000000000000001,noblock_validity,,errors=continue. Quota mode: none. [ 243.831292][ T21] rc_core: IR keymap rc-hauppauge not found [ 243.864144][ T21] Registered IR keymap rc-empty [ 243.875507][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 244.089455][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 244.163516][ T7] hid-u2fzero 0003:10C4:8ACF.0003: unknown main item tag 0x0 [ 244.170960][ T7] hid-u2fzero 0003:10C4:8ACF.0003: unknown main item tag 0x0 [ 244.179075][ T7] hid-u2fzero 0003:10C4:8ACF.0003: unknown main item tag 0x0 [ 244.186560][ T7] hid-u2fzero 0003:10C4:8ACF.0003: unknown main item tag 0x0 [ 244.201773][ T6325] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4128793 free clusters [ 244.216588][ T6325] EXT4-fs (loop6): Delayed block allocation failed for inode 15 at logical offset 31 with max blocks 33 with error 28 [ 244.229042][ T6325] EXT4-fs (loop6): This should not happen!! Data will be lost [ 244.229042][ T6325] [ 244.238764][ T6325] EXT4-fs (loop6): Total free blocks count 0 [ 244.244924][ T6325] EXT4-fs (loop6): Free/Dirty block details [ 244.250869][ T6325] EXT4-fs (loop6): free_blocks=66060288 [ 244.256637][ T6325] EXT4-fs (loop6): dirty_blocks=64 [ 244.262717][ T6325] EXT4-fs (loop6): Block reservation details [ 244.268812][ T6325] EXT4-fs (loop6): i_reserved_data_blocks=4 [ 244.377942][ T21] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 244.849815][ T21] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input13 [ 244.892860][ T7] hid-u2fzero 0003:10C4:8ACF.0003: unknown main item tag 0x0 [ 244.955494][ T7] hid-u2fzero 0003:10C4:8ACF.0003: hidraw0: USB HID v0.00 Device [HID 10c4:8acf] on usb-dummy_hcd.4-1/input0 [ 245.043019][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.074417][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.102006][ T7] hid-u2fzero 0003:10C4:8ACF.0003: U2F Zero LED initialised [ 245.121259][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.135234][ T7] general protection fault, probably for non-canonical address 0xdffffc0000000015: 0000 [#1] PREEMPT SMP KASAN [ 245.147074][ T7] KASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af] [ 245.151337][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.155511][ T7] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 5.15.179-syzkaller #0 [ 245.170615][ T7] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 245.180700][ T7] Workqueue: usb_hub_wq hub_event [ 245.185779][ T7] RIP: 0010:u2fzero_rng_read+0x21a/0x700 [ 245.191443][ T7] Code: df 41 80 7c 05 00 00 74 08 4c 89 f7 e8 8f 02 ef f9 bb a8 00 00 00 49 03 1e 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 e8 02 ef f9 48 8d 54 24 60 48 89 13 [ 245.211096][ T7] RSP: 0018:ffffc90000cc6760 EFLAGS: 00010202 [ 245.217188][ T7] RAX: 0000000000000015 RBX: 00000000000000a8 RCX: dffffc0000000000 [ 245.221147][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.225172][ T7] RDX: 000000000000003b RSI: 0000000000000000 RDI: ffff888067c74469 [ 245.240252][ T7] RBP: ffffc90000cc68f0 R08: dffffc0000000000 R09: ffff888067c7442e [ 245.248250][ T7] R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff888074fc1388 [ 245.256250][ T7] R13: 1ffff1100e9f8206 R14: ffff888074fc1030 R15: 1ffff1100e9f8205 [ 245.264245][ T7] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 245.271267][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.273191][ T7] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 245.286878][ T7] CR2: 00007fd0c759b19c CR3: 00000000617b7000 CR4: 00000000003506f0 [ 245.294963][ T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 245.302960][ T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 245.307386][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.310956][ T7] Call Trace: [ 245.310968][ T7] [ 245.324416][ T7] ? __die_body+0x5e/0xa0 [ 245.328779][ T7] ? die_addr+0x95/0xc0 [ 245.332964][ T7] ? exc_general_protection+0x327/0x4f0 [ 245.338545][ T7] ? asm_exc_general_protection+0x22/0x30 [ 245.344285][ T7] ? u2fzero_rng_read+0x21a/0x700 [ 245.349336][ T7] ? u2fzero_brightness_set+0x280/0x280 [ 245.354911][ T7] ? _raw_spin_unlock+0x40/0x40 [ 245.359778][ T7] ? u2fzero_brightness_set+0x280/0x280 [ 245.362452][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.365340][ T7] add_early_randomness+0x78/0x140 [ 245.377552][ T7] hwrng_register+0x430/0x4c0 [ 245.382253][ T7] devm_hwrng_register+0x43/0xb0 [ 245.387214][ T7] u2fzero_probe+0x266/0x2e0 [ 245.391825][ T7] ? hid_map_usage_clear+0x180/0x180 [ 245.397130][ T7] hid_device_probe+0x2a6/0x3a0 [ 245.402002][ T7] ? hid_uevent+0x310/0x310 [ 245.406528][ T7] really_probe+0x24e/0xb60 [ 245.411058][ T7] __driver_probe_device+0x1a2/0x3d0 [ 245.411207][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.416358][ T7] driver_probe_device+0x50/0x420 [ 245.416385][ T7] __device_attach_driver+0x2b9/0x500 [ 245.433859][ T7] ? deferred_probe_work_func+0x230/0x230 [ 245.439600][ T7] bus_for_each_drv+0x183/0x200 [ 245.444475][ T7] ? subsys_find_device_by_id+0x310/0x310 [ 245.450250][ T7] __device_attach+0x359/0x570 [ 245.455033][ T7] ? device_attach+0x20/0x20 [ 245.459645][ T7] ? kobject_uevent_env+0x36a/0x8d0 [ 245.461154][ T21] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.464856][ T7] bus_probe_device+0xba/0x1e0 [ 245.464882][ T7] ? device_add+0xab9/0xfd0 [ 245.481225][ T7] device_add+0xb48/0xfd0 [ 245.485589][ T7] hid_add_device+0x3a5/0x510 [ 245.490291][ T7] usbhid_probe+0xb32/0xec0 [ 245.494828][ T7] usb_probe_interface+0x5c0/0xaf0 [ 245.499964][ T7] ? usb_register_driver+0x3d0/0x3d0 [ 245.505272][ T7] really_probe+0x24e/0xb60 [ 245.509801][ T7] __driver_probe_device+0x1a2/0x3d0 [ 245.512196][ T21] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 245.515101][ T7] driver_probe_device+0x50/0x420 [ 245.515131][ T7] __device_attach_driver+0x2b9/0x500 [ 245.534530][ T7] ? deferred_probe_work_func+0x230/0x230 [ 245.534943][ T21] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 245.540269][ T7] bus_for_each_drv+0x183/0x200 [ 245.553450][ T7] ? subsys_find_device_by_id+0x310/0x310 [ 245.559191][ T7] ? lockdep_hardirqs_on+0x94/0x130 [ 245.564412][ T7] __device_attach+0x359/0x570 [ 245.569200][ T7] ? kobject_uevent_env+0x36a/0x8d0 [ 245.574499][ T7] ? device_attach+0x20/0x20 [ 245.579107][ T7] ? kobject_uevent_env+0x36a/0x8d0 [ 245.584326][ T7] bus_probe_device+0xba/0x1e0 [ 245.589202][ T7] ? device_add+0xab9/0xfd0 [ 245.593729][ T7] device_add+0xb48/0xfd0 [ 245.598089][ T7] usb_set_configuration+0x19dd/0x2020 [ 245.603577][ T7] usb_generic_driver_probe+0x84/0x140 [ 245.609061][ T7] usb_probe_device+0x130/0x260 [ 245.614107][ T7] ? usb_register_device_driver+0x240/0x240 [ 245.620032][ T7] really_probe+0x24e/0xb60 [ 245.624561][ T7] __driver_probe_device+0x1a2/0x3d0 [ 245.629900][ T7] driver_probe_device+0x50/0x420 [ 245.634955][ T7] __device_attach_driver+0x2b9/0x500 [ 245.640349][ T7] ? deferred_probe_work_func+0x230/0x230 [ 245.646089][ T7] bus_for_each_drv+0x183/0x200 [ 245.650994][ T7] ? subsys_find_device_by_id+0x310/0x310 [ 245.656734][ T7] ? lockdep_hardirqs_on+0x94/0x130 [ 245.661963][ T7] __device_attach+0x359/0x570 [ 245.667016][ T7] ? kobject_uevent_env+0x36a/0x8d0 [ 245.672244][ T7] ? device_attach+0x20/0x20 [ 245.676867][ T7] ? kobject_uevent_env+0x36a/0x8d0 [ 245.682091][ T7] bus_probe_device+0xba/0x1e0 [ 245.686880][ T7] ? device_add+0xab9/0xfd0 [ 245.691405][ T7] device_add+0xb48/0xfd0 [ 245.695958][ T7] usb_new_device+0xc21/0x18f0 [ 245.700763][ T7] ? usb_disconnect+0x8c0/0x8c0 [ 245.705638][ T7] ? do_raw_spin_unlock+0x137/0x8b0 [ 245.710859][ T7] ? _raw_spin_unlock_irq+0x1f/0x40 [ 245.716074][ T7] ? lockdep_hardirqs_on+0x94/0x130 [ 245.721326][ T7] hub_event+0x2cdf/0x54c0 [ 245.725824][ T7] ? led_work+0x700/0x700 [ 245.730174][ T7] ? read_lock_is_recursive+0x10/0x10 [ 245.735563][ T7] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 245.741563][ T7] ? sched_core_share_pid+0x470/0x740 [ 245.746961][ T7] ? do_raw_spin_unlock+0x137/0x8b0 [ 245.752315][ T7] process_one_work+0x8a1/0x10c0 [ 245.757290][ T7] ? worker_detach_from_pool+0x260/0x260 [ 245.762955][ T7] ? _raw_spin_lock_irqsave+0x120/0x120 [ 245.768531][ T7] ? kthread_data+0x4e/0xc0 [ 245.773060][ T7] ? wq_worker_running+0x97/0x170 [ 245.778114][ T7] worker_thread+0xdcf/0x1280 [ 245.782837][ T7] kthread+0x3f6/0x4f0 [ 245.786933][ T7] ? rcu_lock_release+0x20/0x20 [ 245.791815][ T7] ? kthread_blkcg+0xd0/0xd0 [ 245.796434][ T7] ret_from_fork+0x1f/0x30 [ 245.800886][ T7] [ 245.803925][ T7] Modules linked in: [ 245.807924][ C0] vkms_vblank_simulate: vblank timer overrun [ 245.827347][ T7] ---[ end trace f03b08e9969ed09f ]--- [ 245.833109][ T7] RIP: 0010:u2fzero_rng_read+0x21a/0x700 [ 245.838930][ T7] Code: df 41 80 7c 05 00 00 74 08 4c 89 f7 e8 8f 02 ef f9 bb a8 00 00 00 49 03 1e 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 e8 02 ef f9 48 8d 54 24 60 48 89 13 [ 245.878898][ T7] RSP: 0018:ffffc90000cc6760 EFLAGS: 00010202 [ 245.899555][ T7] RAX: 0000000000000015 RBX: 00000000000000a8 RCX: dffffc0000000000 [ 245.935338][ T21] usb 4-1: USB disconnect, device number 9 [ 245.943362][ T7] RDX: 000000000000003b RSI: 0000000000000000 RDI: ffff888067c74469 [ 245.952381][ T7] RBP: ffffc90000cc68f0 R08: dffffc0000000000 R09: ffff888067c7442e [ 245.960543][ T7] R10: ffffffffffffffff R11: dffffc0000000001 R12: ffff888074fc1388 [ 245.970952][ T7] R13: 1ffff1100e9f8206 R14: ffff888074fc1030 R15: 1ffff1100e9f8205 [ 245.979915][ T7] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 245.997449][ T7] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 246.005214][ T7] CR2: 00007ffefdee00b8 CR3: 000000002b33d000 CR4: 00000000003506f0 [ 246.013734][ T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 246.021877][ T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 246.029954][ T7] Kernel panic - not syncing: Fatal exception [ 246.036302][ T7] Kernel Offset: disabled [ 246.040639][ T7] Rebooting in 86400 seconds..